What we protect against, today
Other users cannot see your data. Every piece of data in Timeline — timelines, events, journal entries, contacts — is tied to your account, and every request the application makes is filtered to your account specifically. This isn't a policy promise; it's enforced in the application code on every request.
Data is encrypted at rest and in transit. The database and its backups are encrypted on disk, and all traffic between your browser and Timeline's servers is encrypted (HTTPS/TLS). This protects against, for example, physical theft of server hardware or interception of network traffic — standard practice for any modern web application.
We don't sell or share your data. Timeline doesn't run ads, doesn't share data with advertisers or data brokers, and doesn't use your content to train any external system.
What we do not yet protect against, and why
We want to be direct about this rather than let a confident-sounding privacy policy imply more than is actually true.
The people who administer Timeline's infrastructure can technically read your data. Today, that's a small number of people with direct database access. Nothing in the system today provides a cryptographic barrier between "authenticated as a legitimate administrator" and "can read the contents of any journal entry, todo, or note in the database." This is true of the overwhelming majority of web applications you use today, even though it's rarely stated this plainly.
Why this is a real tradeoff, not an oversight. Timeline's core features — organizing events across time, extracting structure from journal entries, generating anonymized demo data — all require the server to be able to read your content. True "not even we can read it" encryption (the kind used by, say, an end-to-end encrypted messaging app) generally requires giving up exactly those kinds of server-side features, because it means the server only ever sees encrypted data it cannot process. We haven't built Timeline that way, and doing so would be a significant, deliberate product change — not a small fix.
What we do commit to in the meantime:
- Administrative database access is used only for debugging, maintenance, and support — never to browse personal content out of curiosity.
- We are working toward logging administrative database queries against production, so this commitment is auditable rather than only a promise. Until that's in place, it remains a policy commitment backed by the small number of people who currently have access, not a technical guarantee.
- If this policy ever changes — for example, if Timeline adds staff, contractors, or third-party access to production data — this document will be updated before that happens, not after.
Data retention, deletion, and backups
- Regular backups are kept so that data can be recovered in case of accidental deletion, a bug, or infrastructure failure — currently, 30 days of daily backup snapshots, with point-in-time recovery available for the most recent 7 days.
- If you delete an event or your account, it may still exist in backups for up to 30 days before being permanently purged, even though it's removed from the live application immediately. This is standard practice — backups exist specifically to undo mistakes, including accidental deletions — but it means "deleted" is not instantaneous everywhere in the system.
- You can export your own data at any time — this is the most direct way to keep your own independent copy, separate from anything Timeline does on its own infrastructure.
Demo and anonymized data
Timeline maintains demo accounts (for prospective users to try the product) that are populated with anonymized data derived from a real account, not synthetic data invented from nothing. The anonymization process replaces names and identifying details and shifts/clips dates. This process is designed to prevent re-identification, but — consistent with the honesty of this whole document — no anonymization process is a mathematical guarantee against all possible re-identification techniques. Demo accounts are not used to showcase any specific real person's actual, identifiable content.
Questions
This document reflects Timeline's current, early stage. If you have questions about anything here, or about a specific piece of your data, ask directly rather than assuming — this is a small project, and getting a straight answer from a person should always be possible.